{"vulnerability": "cve-2026-108268", "sightings": [{"uuid": "4e5c8e74-78dd-4b24-9c9a-c78166d28b34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108268", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117413053839041888", "content": "CVE-2026-108268 enclave-os-virtual: RA-TLS challenge certificates were not bound to the TLS session Enclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestation. Prior to tdx-v0.2.43 and tdx-gpu-v0.6.27, the TDX/GPU RA-TLS certificate issuer placed the certificate public-key hash and client nonce in quote ReportData but omitted a value bound to the active TLS session. An attacker who obtained an enclave TLS private key could relay a genuine quote onto another connection, causing a relying party to accept an attacker-terminated connection as the attested enclave. This issue is fixed in tdx-v0.2.43 and tdx-gpu-v0.6.27.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108268https://github.com/Privasys/enclave-os-virtual/security/advisories/GHSA-p5fp-g94g-g9m9https://github.com/Privasys/enclave-os-virtual/commit/9a6be91e29f2b6738d0b77c33cd1ad5cd3d8a347https://github.com/Privasys/enclave-os-virtual/releases/tag/tdx-gpu-v0.6.27https://github.com/Privasys/enclave-os-virtual/releases/tag/tdx-v0.2.43https://privasys.org/blog/binding-attestation-to-the-tls-session#Privasys #enclave-os-virtual#CVE_2026_108268#bot", "creation_timestamp": "2026-10-09T21:23:42.192397Z"}, {"uuid": "c797a292-1f03-4738-8c35-6be4342ee74d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108268", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/7tcv5yhpy7yci", "content": "CVE-2026-108268 - enclave-os-virtual: RA-TLS challenge certificates were not bound to the TLS session\nCVE ID : CVE-2026-108268\n \n Published : Oct. 9, 2026, 10:16 p.m. | 1\u00a0hour, 3\u00a0minutes ago\n \n Description : Enclave OS Virtual runs container workloads inside confidential virtu...", "creation_timestamp": "2026-10-09T23:56:20.422121Z"}, {"uuid": "69b8971d-0c94-48ff-975e-086f69039de6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108268", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxi72hqbt52o", "content": "\ud83d\udea8 CVE-2026-108268 \u2014 CVSS 9.1 CRITICAL\n\nEnclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestatio...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-108268\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-10T00:07:41.683196Z"}, {"uuid": "36a0b18b-f277-4209-a9b5-6e5e539780ba", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-108268", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxid3upx6j2x", "content": "CVE-2026-108268 - enclave-os-virtual\nThe Enclave OS Virtual software that runs container workloads in secure virtual machines could be tricked into accepting a fake proof of its identity if an attacker steals its\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#privasys #CVE #infosec", "creation_timestamp": "2026-10-10T01:20:04.489329Z"}, {"uuid": "44031784-1f94-4afd-b90b-1564abd23001", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-108268", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117414377789581647", "content": "CVE-2026-108268 (CRITICAL, CVSS 9.1): Privasys enclave-os-virtual <0.2.43/<0.6.27 origin validation error lets attackers relay attestation quotes if they have the enclave TLS private key. Upgrade to patched versions ASAP. https://radar.offseq.com/threat/cve-2026-108268-cwe-346-origin-validation-error-in-privasys-enclave-os-virtual-3494df223a867096 #OffSeq #CVE2026108268 #Vuln", "creation_timestamp": "2026-10-10T03:00:24.526236Z"}, {"uuid": "18b0d22b-7e8c-4b18-9158-510c7c559b6f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-108268", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mxiipdmhmk2j", "content": "CRITICAL: Privasys enclave-os-virtual (<0.2.43/<0.6.27) origin validation bug enables relay attacks \u2014 attacker can spoof enclave attestation. Update to fixed versions now. https://radar.offseq.com/threat/cve-2026-108268-cwe-346-origin-validation-error-in-privasys-enclave-os-virtual-3494df223a8670...", "creation_timestamp": "2026-10-10T03:00:26.535183Z"}]}